Overview

overview

10

Static

static

97ae8e0ee6...4f.exe

windows7_x64

10

97ae8e0ee6...4f.exe

windows10-2004_x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    97ae8e0ee6b8a129ffe8abe444d0754f
  • Size 466KB
  • Sample220119-vreasabgh7
  • SHA256 10ff5c8bac827b012bc5b6f789e7c23913b662453cd0bcc7f3f5192260d7a950
  • MD5 SHA1 SHA512
Score
10/10
xloaderp86floaderrat

Malware Config

Extracted

Family

  • xloader

Version

  • 2.5

Campaign

  • p86f

Decoy

  • lawrencetodolist.com

  • ci-ohio.com

  • otpravka-pochti-23v.xyz

  • evolutiondesign.academy

  • anentdugloord.com

  • niftyresult.com

  • partner2form.com

  • hffznt.com

  • asukas.online

  • heidefine.xyz

  • secure-c5.com

  • greenlink-engineering.com

  • dextraseo.online

  • apricitee.com

  • kenyansinus.com

  • dailangxiaozhan.com

  • deuxfemmes.store

  • overway.store

  • herostea.com

  • shaneparrottllc.com

Targets

    • Target
      97ae8e0ee6b8a129ffe8abe444d0754f
    • Size 466KB
    • SHA256 10ff5c8bac827b012bc5b6f789e7c23913b662453cd0bcc7f3f5192260d7a950
    • MD5 SHA1 SHA512
    Score
    10/10
    xloaderp86floaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks